Linus Torvalds and Dirk Hohndel at Open Source Summit North America 2026
sjvn/ZDNET
Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- Torvalds appreciates AI, yet AI occasionally clashes with Torvalds.
- Linux’s creator believes programming jobs will persist.
- AI remains a double-edged sword in detecting and resolving security flaws.
At the Linux Foundation’s Open Source Summit North America, Linus Torvalds discussed how modern AI tools are transforming kernel development, increasing contribution rates, and revealing new social and security challenges in the open-source community. However, he emphasized that “AI is a useful tool, but it’s just a tool” rather than a complete replacement for human programmers.
Now, if only the companies cutting tech jobs left and right would pay attention.
Also: Microsoft surprises with its first server Linux distribution: Azure Linux 4.0
Torvalds spoke with Verizon’s Open Source Program Office Head Dirk Hohndel, who is also a Linux kernel maintainer and a friend of Torvalds’. Torvalds added that while the Linux kernel’s release process has remained stable “for nearly 20 years” since adopting Git, that pattern changed about six months ago as AI coding tools gained popularity.
“In the last six months, we’ve seen a significant increase in commits,” Torvalds noted, estimating that “the last two releases have seen about 20% more commits than in previous releases over many years.”
Initially, Torvalds misinterpreted the spike as excitement around a major version change: “At first I thought, ‘hey, people are excited about the 7.0 release because I changed the major number every once in a while…’ and it turns out I was wrong. The real change that happened in the last six months was that the AI tools actually got good enough for a lot of people… we’re seeing a definite uptick in development on pretty much all fronts.”
Torvalds acknowledged that the new tools lower the barrier of entry for contributors, echoing Hohndel’s observation that “the tooling actually lowers this initial barrier… [and] does a big chunk of the work.” But he emphasized that the real impact is social rather than purely technical: “The big pain points in Linux, traditionally, and I suspect in most projects, have not been so much the code itself, but… when you are forced to change how you work.”
Also: Ubuntu Core 26 offers an immutable Linux you can trust through 2041
One of the biggest flashpoints has been the Linux kernel security mailing list, which Torvalds said was recently “overrun by duplicate reports” generated with AI.
“People think that when they find a bug with AI, the first reaction sometimes seems to be, let’s send it to the security list, because this may have security implications,” he said. The result, on a deliberately small, confidential list, was that “we were flooded by people sending bugs, and then you have this list with very few people on it… and we spent all our time just forwarding these reports to… the other developers who knew that area better.”
AI and Security
To cope, Torvalds announced new AI security disclosure guidelines with a blunt rule: “If you find a security bug with AI, you should basically consider it to be public, just because if you found it with AI, 100 other people also found it with AI.”
At the same time, he urged researchers not to publish working exploits: “When it comes to things that really are security issues, you may not want to make the exploit public… Don’t be that guy who then crows about it publicly and says, ‘Look, I could bring down this big company.'”
Torvalds linked the disclosure debate to broader shifts in the security ecosystem. In the past, he said, the kernel community would quietly notify distributions about a bug and ask them to upgrade without detailing the vulnerability, and “most of the time, nobody would figure out what happened.” Now, with AI‑accelerated analysis, he recalled that “last week, we fixed the bug; within three hours, there was a blog post about the implications of that bug fix, because security people love getting attention.”
Also: The 4th Linux kernel flaw this month can lead to stolen SSH host keys
He went out of his way to argue that closing the source is not an answer: “I don’t think, for example, that the solution is to not do open source, because if you think that AI can’t reverse engineer closed source, you’re in for a surprise.” In fact, he warned, “closed source is even worse in this respect, because the AI can’t help you fix the problems, but the AI sure can help find those problems in the first place.”
Torvalds is right. While Windows vulnerabilities, except for the truly horrid ones, no longer receive much attention, AI is also finding plenty of security holes in Windows as well. As Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, observed recently, “Microsoft’s total count came to 1,139 CVEs patched in 2025,” which was the second-highest, behind 2020. Childs expects, “as AI bugs become more prevalent, this number is likely to go higher in 2026.”
Meanwhile, back at Open Source Summit, Hohndel criticized vendors who hype vulnerabilities without responsibly coordinating fixes. He cited four recent local privilege escalation bugs in the kernel, “two of which were disclosed exactly” with branded names, domains, and logos before maintainers were contacted. “My response is always, here is a company I never want to work with, because if you do that to the Linux kernel, you do this to anyone.”
Love, hate, and AI
As annoying as this is, Torvalds admitted to having a love‑hate relationship with AI. “I actually really like it from a technical angle. I love the tools. I find it very useful and interesting, but it is definitely causing pain points,” he said.
Also: 10 trillion downloads are crushing open-source repositories – here’s what they’re doing about it
On the positive side, he framed AI‑discovered bugs as “short-term pain” with long‑term benefits: “When AI finds a bug in any source code… long term is you found a bug, we fixed it, that the end result is better for it.” After all, he continued, “I think finding bugs is great, because the real problem is all the bugs you didn’t find.”
But he warned of “social choke points and social pain points” as AI pours traffic into already overstretched communities, especially in the “10s of 1000s of random projects that people maintain that are not the Linux kernel.” For small teams or solo maintainers, he said, flood‑style AI bug reports can cause real burnout, especially when “it’s a bug report, and when you ask for more information, the person has done a drive-by and doesn’t even answer your questions anymore.”
Torvalds added that maintenance is increasingly about people rather than code. “For me, as a top-level maintainer, I don’t do a lot of coding. My job is working with people, and I do not use AI to work with people. Thank you. And I should suggest you don’t do that either.” Torvalds has come a long way from the days when he was known for treating poor coders with contempt.
The future of AI and programming work
Stepping away from
When asked what guidance he’d offer to newcomers entering the field amid widespread pessimistic predictions that “all code will be written by AI,” Torvalds firmly challenged the hype.
“I’ve always believed that AI is a valuable tool — but it’s just a tool. And when I hear people claim, ‘hey, 99% of our code is written by AI,’ it genuinely frustrates me.”
He pointed out the irony that “100% of their code is actually written by compilers,” and walked through his own evolution from manually entering machine code to using assemblers, then compilers, and now AI assistants. “I started out writing machine code — and I don’t mean assembly language, I mean raw numbers,” he explained. “It took me some time to realize that manually writing out those numbers and computing branch offsets was pretty foolish, and that people had already built this thing called an assembler. Later on, I came to appreciate compilers as well. These days, I’m coming to appreciate AI tools too.”
So Torvalds maintained, “I’m absolutely certain that AI is transforming programming, but it’s not altering the core principles.” Just as compilers boosted productivity “by a factor of 1,000,” he predicts that “AI will boost your productivity by a factor of 10,” but he’s adamant that “AI is great, but it’s not redefining what programming is.”
Rather, he argued, “many people will use AI to produce the code that compilers then use to produce the code that assemblers then use to produce the machine code. This is revolutionary in exactly the same way that previous revolutions were.”
Importantly, Torvalds emphasized, aspiring developers still need to grasp what their tools actually generate. “You really do need to understand how everything works under the hood,” he said. “Even when I use AI for my hobby projects, I’ll use AI to generate code, I’ll review that code, and I’ll still examine the assembly language… because that’s what I learned on.” For any serious, long-lasting system, he cautioned, “you need to understand not just your prompts, but you need to understand the final output as well — because that’s the only way you can maintain it over the long run.”
Also: 51% of professionals say AI workslop lowers their productivity — stop it in 2 steps
Throughout the discussion, Torvalds kept coming back to a central idea: open source and now AI tools are powerful ways to handle software complexity, but they don’t eliminate the need for human judgment, community standards, and a thorough understanding of the systems being built.
“Software is incredibly complex,” he said, and “the only truly effective way to manage the complexity of a large-scale infrastructure is open source,” with AI now added as simply another tool in the developer’s toolkit.
